Dashboards & Visualizations

Simple XML: Dynamic variables/value in choice tag

koshyk
Super Champion

hi,
I'm building a simple xml form so that user can select via dropdown. I've got a situation where the "Metric" logic is different. I'm currently trying to put the logic as choice value, but it doesn't not accept dynamic value (eg $Report_Type$). Hence during search, it comes up as $Report_Type$ instead of "ReportA". Any way to overcome this issue? (OR Any other method to set dynamic variable in simpleXML is also appreciated)

Example below

    <input type="radio" token="Report_Type" searchWhenChanged="true">
      <label>Select a Report:</label>
          <default>ReportA</default>

          <!-- Define the choices in code -->
          <choice value="ReportA">ReportA</choice>
          <choice value="ReportB">ReportB</choice>
    </input>

    <input type="dropdown" token="Metric" searchWhenChanged="true">
      <label>Select a Metric:</label>
          <default>Count</default>    
          <choice value="stats sum(count) by Time_Bucket,$Report_Type$| rename sum(count) as Customer_COUNT ">Count</choice>
          <choice value="eventstats max(count) as MAXVAL by $Report_Type$ | where (count=MAXVAL)| rename count as Customer_MAX_COUNT">Peak</choice>
    </input>        

    <row>
    <table>
    <searchPostProcess>$Metric$ ... Some other calculation</searchPostProcess>
      <option name="drilldown">off</option>
      <option name="showPager">true</option>
      <option name="count">20</option>
    </table>
  </row>
Tags (2)
0 Karma

somesoni2
Revered Legend

Try something like this (run anywhere xml code)

<form>
  <label>ReportType</label>
  <fieldset>
    <input type="radio" token="varIndex" searchWhenChanged="true">
      <label>Select an Index:</label>
      <default>_internal</default>
      <!-- Define the choices in code -->
      <choice value="_internal">_internal</choice>
      <choice value="main">main</choice>
    </input>
    <input type="dropdown" token="Metric" searchWhenChanged="true">
      <label>Select a Metric:</label>
      <default>Count</default>
      <populatingSearch fieldForLabel="key"  fieldForValue="value" >
        index="$varIndex$" | stats count as value | eval key="Count" | append [search index="$varIndex$" | stats count by date_mday | stats max(count) as value | eval key="Peak"]
      </populatingSearch>
    </input>
  </fieldset>
  <row>
    <table>
      <title>Log events</title>
      <searchString>|stats count  | eval Metric="$Metric$" | table Metric</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>
  <row>
    <table>
      <title>Dropdown query</title>
      <searchString>index="$varIndex$" | stats count as value | eval key="Count" | append [search index="$varIndex$" | stats count by date_mday | stats max(count) as value | eval key="Peak"]</searchString>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>     
    </table>
  </row>
</form>
0 Karma

DavidHourani
Super Champion

Why not combine both choices into the same dropdown list and have 4 choices instead of 2 like:

1- Count For ReportA

2- Peak For Report A

3- Count For Report B

4- Peak For Report B

You can also try troubleshooting to check if "report_Type" is actually taking the default value...try putin $Report_Type$ in a title or something just to make sure that you can read the choice you made...if you can't read the choice it's probably a problem with the radio button...try replacing it with a drowndown list if you want 🙂

0 Karma

tugnet
Explorer

did you find any solution? got the same problem 😕

0 Karma

koshyk
Super Champion

unfortunately, not. I had to switch to advanced XML (sidieviewutil) for this.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...